This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive

+

This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the [[Funtoo Linux Installation]] Guide.

−

= Prepare the hard drive and partitions =

+

== Prepare the hard drive and partitions ==

This is an example partition scheme, you may want to choose differently.

This is an example partition scheme, you may want to choose differently.

<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.

<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.

−

+

* <code>/dev/sda1</code> -- <code>/boot</code> partition.

−

* <code>/dev/sda1</code> -- <code>/boot</code> partition.

+

* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.

* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.

* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.

* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.

+

With UEFI:

+

* <code>/dev/sda1</code> -- <tt>/boot</tt>

+

* <code>/dev/sda2</code> -- <tt>/</tt> partition

+

+

=== Wipe the hard drive ===

<console>

<console>

−

##r### ##b##dd if=/dev/zero of=/dev/sda3 bs=100M

+

# ##i##gdisk /dev/sda

−

##r### ##b##dd if=/dev/urandom of=/dev/sda3 bs=100M

+

+

Command: ##i##x ↵

+

Expert command: ##i##z ↵

+

About to wipe out GPT on /dev/sda. Proceed?: ##i##y ↵

+

GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.

+

Blank out MBR?: ##i##y ↵

</console>

</console>

−

The <code>dd</code> part is optional, and the command only needs to be run for security reasons (i.e only if you had top secret files on your drive). The command overwrites the lingering data on the device with random data. It takes around 6 hours to complete for a 200GB drive.

+

{{Fancywarning|This action will destroy all data on the disk.}}

−

Note that you will get a message about reaching the end of the device when the <code>dd</code> command has finished. This behavior is intended.

+

== Encrypting the drive ==

+

Read more about different cipher options here: [http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/]

+

<console>

+

# ##i##cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3

+

</console>

+

+

Or use SHA512 for increase security. Do NOT use SHA-1: LUKS disk encryption. As the cryptography expert Bruce Schneier already told in year 2005, do not use SHA-1 because its broken. See his article here: [http://www.schneier.com/blog/archives/2005/02/sha1_broken.html]

{{Fancywarning|The default keymap at boot time is '''us'''. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.}}

= Create logical volumes =

= Create logical volumes =

<console>

<console>

−

##r### ##b##pvcreate /dev/mapper/dmcrypt_root

+

# ##i##pvcreate /dev/mapper/dmcrypt_root

−

##r### ##b##vgcreate vg /dev/mapper/dmcrypt_root

+

# ##i##vgcreate vg /dev/mapper/dmcrypt_root

−

##r### ##b##lvcreate -L10G --name root vg

+

# ##i##lvcreate -L10G --name root vg

−

##r### ##b##lvcreate -L2G --name swap vg

+

# ##i##lvcreate -L2G --name swap vg

−

##r### ##b##lvcreate -L5G --name portage vg

+

# ##i##lvcreate -L5G --name portage vg

−

##r### ##b##lvcreate -l 100%FREE -nhome vg

+

# ##i##lvcreate -l 100%FREE -nhome vg

</console>

</console>

Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.

Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.

+

{{fancynote| Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.}}

= Create a filesystem on volumes =

= Create a filesystem on volumes =

<console>

<console>

−

##r### ##b##mkfs.ext2 /dev/sda1

+

# ##i##mkfs.ext2 /dev/sda1

−

##r### ##b##mkswap /dev/mapper/vg-swap

+

# ##i##mkswap /dev/mapper/vg-swap

−

##r### ##b##mkfs.ext4 /dev/mapper/vg-root

+

# ##i##mkfs.ext4 /dev/mapper/vg-root

−

##r### ##b##mkfs.ext4 /dev/mapper/vg-portage

+

# ##i##mkfs.ext4 /dev/mapper/vg-portage

−

##r### ##b##mkfs.ext4 /dev/mapper/vg-home

+

# ##i##mkfs.ext4 /dev/mapper/vg-home

</console>

</console>

= Basic system setup =

= Basic system setup =

<console>

<console>

−

##r### ##b##swapon /dev/mapper/vg-swap

+

# ##i##swapon /dev/mapper/vg-swap

−

##r### ##b##mkdir /mnt/funtoo

+

# ##i##mkdir /mnt/funtoo

−

##r### ##b##mount /dev/mapper/vg-root /mnt/funtoo

+

# ##i##mount /dev/mapper/vg-root /mnt/funtoo

−

##r### ##b##mkdir -p /mnt/funtoo/{boot,usr/portage,home}

+

# ##i##mkdir -p /mnt/funtoo/{boot,usr/portage,home}

−

##r### ##b##mount /dev/sda1 /mnt/funtoo/boot

+

# ##i##mount /dev/sda1 /mnt/funtoo/boot

−

##r### ##b##mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage

+

# ##i##mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage

−

##r### ##b##mount /dev/mapper/vg-home /mnt/funtoo/home

+

# ##i##mount /dev/mapper/vg-home /mnt/funtoo/home

</console>

</console>

Now perform all the steps required for basic system install, please follow [http://docs.funtoo.org/wiki/Funtoo_Linux_Installation]

Now perform all the steps required for basic system install, please follow [http://docs.funtoo.org/wiki/Funtoo_Linux_Installation]

Line 61:

Line 81:

* '''lvm2'''

* '''lvm2'''

* '''a bootloader (grub recommended)'''

* '''a bootloader (grub recommended)'''

−

* '''kernel sources (gentoo-sources recommended)'''

+

* '''kernel sources '''

= Editing the fstab =

= Editing the fstab =

Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:

Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:

−

<console>

+

+

{{file|name=/etc/fstab|desc= |body=

# <fs> <mountpoint> <type> <opts> <dump/pass>

# <fs> <mountpoint> <type> <opts> <dump/pass>

/dev/sda1 /boot ext2 noauto,noatime 1 2

/dev/sda1 /boot ext2 noauto,noatime 1 2

Line 73:

Line 94:

/dev/mapper/vg-portage /usr/portage ext4 noatime,nodiratime 0 0

/dev/mapper/vg-portage /usr/portage ext4 noatime,nodiratime 0 0

/dev/mapper/vg-home /home ext4 noatime,nodiratime 0 0

/dev/mapper/vg-home /home ext4 noatime,nodiratime 0 0

−

</console>

+

}}

−

= Kernel options =

+

== Kernel options ==

−

{{Note}}This part is particularly important: pay close attention.

+

{{fancynote| This part is particularly important: pay close attention. }}<br>

Latest revision as of 17:34, May 10, 2015

This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the Funtoo Linux Installation Guide.

Prepare the hard drive and partitions

This is an example partition scheme, you may want to choose differently.
/dev/sda1 used as /boot. /dev/sda2 will be encrypted drive with LVM.

/dev/sda1 -- /boot partition.

/dev/sda2 -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [1] for more information on GPT and MBR.

/dev/sda3 -- / partition, will be the drive with LUKS and LVM.

With UEFI:

/dev/sda1 -- /boot

/dev/sda2 -- / partition

Wipe the hard drive

# gdisk /dev/sda
Command: x ↵
Expert command: z ↵
About to wipe out GPT on /dev/sda. Proceed?: y ↵
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
Blank out MBR?: y ↵

Warning

This action will destroy all data on the disk.

Encrypting the drive

Or use SHA512 for increase security. Do NOT use SHA-1: LUKS disk encryption. As the cryptography expert Bruce Schneier already told in year 2005, do not use SHA-1 because its broken. See his article here: [3]

The default keymap at boot time is us. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.

>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2: